/home/techb158/cosmic.abdallabala.com/data
Edit: /home/techb158/cosmic.abdallabala.com/data/sample-project.json (30154B)
{
"project": {
"id": "cosmic-ai-risk-001",
"name": "COSMIC AI-Risk Management",
"subtitle": "Integrated Measurement Framework for AI Project Risks",
"projectType": "AI-Enabler",
"lifecyclePhase": "Testing and performance evaluation",
"assessmentDate": "2026-07-03",
"owner": "AI Risk Governance Team",
"riskAppetite": 50,
"description": "Prototype dashboard for measuring AI project risk using organizational, technical, and human dimensions."
},
"sourceBasis": {
"derivedFromSource": [
"COSMIC AI-Risk Management presentation",
"AI Governance Triangle: organizational, technical, human dimensions",
"ISO 15939 and VIM-aligned measurement intent",
"Software prototype and REST API objective",
"Phase 3 software and API implementation timeline"
],
"implementationExtension": [
"Dashboard widgets",
"Risk scoring formula",
"Deployment gate rules",
"Trello board mapping",
"Sample risks and metrics"
]
},
"indicators": [
{
"id": "IND-001",
"name": "Overall AI Risk Score",
"measurand": "Combined residual exposure across active risks",
"unit": "0-100 normalized score",
"interpretation": "Higher score means greater residual AI project risk."
},
{
"id": "IND-002",
"name": "Mitigation Completion",
"measurand": "Completed mitigation actions divided by planned mitigation actions",
"unit": "Percent",
"interpretation": "Below 60 percent blocks the deployment gate in this implementation."
},
{
"id": "IND-003",
"name": "Data Readiness",
"measurand": "Data quality, documentation, consent, privacy, and lineage readiness",
"unit": "0-100 normalized score",
"interpretation": "Below 70 increases technical and legal risk."
},
{
"id": "IND-004",
"name": "Model Performance Readiness",
"measurand": "Selected model performance against project threshold",
"unit": "Pass, Warning, Fail",
"interpretation": "Fail blocks deployment. Warning requires reviewer acceptance."
},
{
"id": "IND-005",
"name": "Ethical Review Status",
"measurand": "Completion and approval of ethical review",
"unit": "Status",
"interpretation": "Pending or rejected status blocks deployment for sensitive AI systems."
},
{
"id": "IND-006",
"name": "Legal Review Status",
"measurand": "Completion and approval of legal and privacy review",
"unit": "Status",
"interpretation": "Pending or rejected status blocks deployment."
}
],
"lifecycle": [
{
"id": "LC-01",
"name": "Needs identification",
"status": "Complete",
"readiness": 84
},
{
"id": "LC-02",
"name": "Data collection and preparation",
"status": "Warning",
"readiness": 68
},
{
"id": "LC-03",
"name": "Design",
"status": "Complete",
"readiness": 76
},
{
"id": "LC-04",
"name": "Model development and training",
"status": "Warning",
"readiness": 71
},
{
"id": "LC-05",
"name": "Testing and performance evaluation",
"status": "Warning",
"readiness": 64
},
{
"id": "LC-06",
"name": "Deployment, support, and monitoring",
"status": "Blocked",
"readiness": 52
}
],
"reviews": {
"dataReadiness": {
"score": 68,
"status": "Warning",
"evidence": "Data lineage and consent records incomplete for two sources."
},
"ethicalReview": {
"status": "Pending",
"evidence": "Bias and accountability review still open."
},
"legalReview": {
"status": "Pending",
"evidence": "Privacy impact assessment not approved."
},
"deploymentApproval": {
"status": "Not approved",
"evidence": "Risk owner approval required before production release."
}
},
"experiments": [
{
"id": "EXP-001",
"name": "Baseline classifier",
"model": "Logistic Regression",
"dataset": "v1.0",
"accuracy": 0.78,
"f1": 0.74,
"precision": 0.76,
"recall": 0.72,
"auc": 0.81,
"biasStatus": "Warning",
"stability": 72,
"reproducibility": "Complete",
"selected": false
},
{
"id": "EXP-002",
"name": "Transformer model v2",
"model": "Fine-tuned transformer",
"dataset": "v1.1",
"accuracy": 0.84,
"f1": 0.82,
"precision": 0.83,
"recall": 0.81,
"auc": 0.88,
"biasStatus": "Fail",
"stability": 68,
"reproducibility": "Partial",
"selected": true
},
{
"id": "EXP-003",
"name": "Regularized model v3",
"model": "Gradient boosted model",
"dataset": "v1.2",
"accuracy": 0.82,
"f1": 0.79,
"precision": 0.80,
"recall": 0.78,
"auc": 0.86,
"biasStatus": "Pass",
"stability": 81,
"reproducibility": "Complete",
"selected": false
}
],
"thresholds": {
"overallRiskMax": 50,
"criticalOpenMax": 0,
"mitigationCompletionMin": 60,
"dataReadinessMin": 70,
"selectedModelF1Min": 0.8,
"selectedModelStabilityMin": 75,
"gateWarningScore": 35,
"gateBlockedScore": 50
},
"risks": [
{
"id": "R-001",
"title": "Prompt injection can override customer-support chatbot safeguards",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 4,
"impact": 5,
"detectability": 4,
"mitigationProgress": 45,
"mitigationEffectiveness": 55,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Security Lead",
"dueDate": "2026-07-08",
"evidence": "Adversarial prompt test suite partially complete.",
"mitigations": [
"Add system prompt hardening",
"Run red-team prompt injection tests",
"Add output policy filter"
]
},
{
"id": "R-002",
"title": "Hallucinated legal advice from AI assistant",
"dimension": "Human",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 3,
"impact": 5,
"detectability": 4,
"mitigationProgress": 35,
"mitigationEffectiveness": 60,
"status": "Open",
"approvalStatus": "Pending",
"owner": "Legal Reviewer",
"dueDate": "2026-07-10",
"evidence": "Legal disclaimer and escalation workflow not approved.",
"mitigations": [
"Restrict legal advice responses",
"Add legal escalation path",
"Review high-risk prompts"
]
},
{
"id": "R-003",
"title": "Personal data leakage in AI-generated summaries",
"dimension": "Technical",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Data collection and preparation",
"probability": 4,
"impact": 5,
"detectability": 3,
"mitigationProgress": 50,
"mitigationEffectiveness": 65,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Data Protection Lead",
"dueDate": "2026-07-08",
"evidence": "PII masking checks passing for structured fields only.",
"mitigations": [
"Add PII redaction before summarization",
"Audit prompt and output logs",
"Complete privacy review"
]
},
{
"id": "R-004",
"title": "Bias in candidate-ranking model",
"dimension": "Human",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 4,
"impact": 5,
"detectability": 4,
"mitigationProgress": 42,
"mitigationEffectiveness": 60,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Responsible AI Lead",
"dueDate": "2026-07-12",
"evidence": "Disparate impact metric exceeds threshold for one group.",
"mitigations": [
"Run fairness evaluation",
"Tune decision thresholds",
"Add reviewer override process"
]
},
{
"id": "R-005",
"title": "Inaccurate financial risk classification",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Model development and training",
"probability": 3,
"impact": 5,
"detectability": 3,
"mitigationProgress": 62,
"mitigationEffectiveness": 65,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Model Owner",
"dueDate": "2026-07-18",
"evidence": "Recall is below target in high-risk segment.",
"mitigations": [
"Improve class weighting",
"Review false negatives",
"Update model threshold"
]
},
{
"id": "R-006",
"title": "Unsafe medical recommendation from AI assistant",
"dimension": "Human",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 2,
"impact": 5,
"detectability": 4,
"mitigationProgress": 30,
"mitigationEffectiveness": 70,
"status": "Open",
"approvalStatus": "Rejected",
"owner": "Clinical Safety Reviewer",
"dueDate": "2026-07-06",
"evidence": "Unsafe advice scenario failed review.",
"mitigations": [
"Block medical diagnosis content",
"Add emergency disclaimer",
"Route users to human professional"
]
},
{
"id": "R-007",
"title": "Vendor LLM outage affecting production workflows",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 4,
"detectability": 3,
"mitigationProgress": 58,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Supplier Manager",
"dueDate": "2026-07-20",
"evidence": "Fallback model contract still under review.",
"mitigations": [
"Define fallback provider",
"Add circuit breaker",
"Test degraded mode"
]
},
{
"id": "R-008",
"title": "Model drift after deployment",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 4,
"impact": 4,
"detectability": 3,
"mitigationProgress": 55,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "MLOps Lead",
"dueDate": "2026-07-22",
"evidence": "Drift dashboard exists but alert thresholds are not approved.",
"mitigations": [
"Monitor input distribution drift",
"Set retraining triggers",
"Define rollback threshold"
]
},
{
"id": "R-009",
"title": "Training data lacks consent record",
"dimension": "Organizational",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Data collection and preparation",
"probability": 3,
"impact": 5,
"detectability": 3,
"mitigationProgress": 40,
"mitigationEffectiveness": 75,
"status": "Open",
"approvalStatus": "Pending",
"owner": "Data Steward",
"dueDate": "2026-07-09",
"evidence": "Consent status missing for two supplier data feeds.",
"mitigations": [
"Trace consent records",
"Remove unverified data",
"Update data source register"
]
},
{
"id": "R-010",
"title": "Poor explainability for reviewer decisions",
"dimension": "Human",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Design",
"probability": 3,
"impact": 4,
"detectability": 3,
"mitigationProgress": 63,
"mitigationEffectiveness": 65,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "UX Lead",
"dueDate": "2026-07-13",
"evidence": "Reason codes displayed for only three decision classes.",
"mitigations": [
"Add model explanation card",
"Define reason code taxonomy",
"Validate reviewer comprehension"
]
},
{
"id": "R-011",
"title": "Low F1 score under project threshold",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 3,
"impact": 4,
"detectability": 2,
"mitigationProgress": 66,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "ML Engineer",
"dueDate": "2026-07-11",
"evidence": "Selected model meets F1 threshold but stability warning remains.",
"mitigations": [
"Compare candidate models",
"Tune hyperparameters",
"Validate on holdout set"
]
},
{
"id": "R-012",
"title": "Test data leakage from training split",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Model development and training",
"probability": 2,
"impact": 5,
"detectability": 4,
"mitigationProgress": 75,
"mitigationEffectiveness": 80,
"status": "In mitigation",
"approvalStatus": "Approved",
"owner": "Data Scientist",
"dueDate": "2026-07-14",
"evidence": "Leakage scan passed after split correction.",
"mitigations": [
"Rebuild train-test split",
"Audit feature generation",
"Lock validation set"
]
},
{
"id": "R-013",
"title": "Unclear business objective for AI use case",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Needs identification",
"probability": 2,
"impact": 4,
"detectability": 2,
"mitigationProgress": 90,
"mitigationEffectiveness": 75,
"status": "Closed",
"approvalStatus": "Accepted",
"owner": "Product Owner",
"dueDate": "2026-06-25",
"evidence": "Business objective and acceptance criteria approved.",
"mitigations": [
"Define measurable objective",
"Confirm stakeholder acceptance criteria"
]
},
{
"id": "R-014",
"title": "Missing risk owner for deployment approval",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 2,
"impact": 4,
"detectability": 3,
"mitigationProgress": 70,
"mitigationEffectiveness": 80,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "PMO Lead",
"dueDate": "2026-07-05",
"evidence": "Delegated owner named, final approval pending.",
"mitigations": [
"Assign gate owner",
"Document approval workflow"
]
},
{
"id": "R-015",
"title": "Unapproved data source in model pipeline",
"dimension": "Organizational",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Data collection and preparation",
"probability": 3,
"impact": 4,
"detectability": 3,
"mitigationProgress": 52,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Data Governance Lead",
"dueDate": "2026-07-15",
"evidence": "Supplier data source missing governance approval.",
"mitigations": [
"Review data source approval",
"Document data lineage",
"Add approval gate to pipeline"
]
},
{
"id": "R-016",
"title": "Cost overrun from model inference volume",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 3,
"detectability": 2,
"mitigationProgress": 65,
"mitigationEffectiveness": 60,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Finance Lead",
"dueDate": "2026-07-19",
"evidence": "Monthly inference budget forecast exceeds baseline by 18 percent.",
"mitigations": [
"Add usage caps",
"Introduce caching",
"Track cost per request"
]
},
{
"id": "R-017",
"title": "Inadequate monitoring after deployment",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 4,
"impact": 4,
"detectability": 4,
"mitigationProgress": 48,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "MLOps Lead",
"dueDate": "2026-07-18",
"evidence": "Monitoring coverage excludes bias and latency alerts.",
"mitigations": [
"Define monitoring KPIs",
"Add model drift alert",
"Add incident response workflow"
]
},
{
"id": "R-018",
"title": "Poor user adoption of AI recommendations",
"dimension": "Human",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 3,
"detectability": 2,
"mitigationProgress": 58,
"mitigationEffectiveness": 55,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Change Manager",
"dueDate": "2026-07-21",
"evidence": "User training plan drafted but not delivered.",
"mitigations": [
"Run user training",
"Collect feedback",
"Improve explanation UX"
]
},
{
"id": "R-019",
"title": "Human-in-the-loop review bypassed under workload pressure",
"dimension": "Human",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 5,
"detectability": 4,
"mitigationProgress": 44,
"mitigationEffectiveness": 70,
"status": "Open",
"approvalStatus": "Pending",
"owner": "Operations Lead",
"dueDate": "2026-07-17",
"evidence": "No enforcement mechanism for mandatory review cases.",
"mitigations": [
"Make review mandatory for high-risk cases",
"Log reviewer decision",
"Audit bypass events"
]
},
{
"id": "R-020",
"title": "Incomplete incident response playbook for AI failures",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 4,
"detectability": 3,
"mitigationProgress": 57,
"mitigationEffectiveness": 75,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Incident Manager",
"dueDate": "2026-07-16",
"evidence": "Runbook lacks AI-specific rollback decision tree.",
"mitigations": [
"Define incident severity levels",
"Create rollback playbook",
"Assign escalation contacts"
]
},
{
"id": "R-021",
"title": "Security vulnerability in prompt logging",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Design",
"probability": 3,
"impact": 4,
"detectability": 4,
"mitigationProgress": 60,
"mitigationEffectiveness": 75,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Security Lead",
"dueDate": "2026-07-12",
"evidence": "Sensitive prompt fields encrypted, retention policy pending.",
"mitigations": [
"Encrypt prompt logs",
"Mask sensitive fields",
"Set retention limits"
]
},
{
"id": "R-022",
"title": "Missing rollback procedure for model release",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 5,
"detectability": 3,
"mitigationProgress": 49,
"mitigationEffectiveness": 80,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Release Manager",
"dueDate": "2026-07-14",
"evidence": "Rollback documented but not tested.",
"mitigations": [
"Define rollback trigger",
"Test rollback drill",
"Version model artifacts"
]
},
{
"id": "R-023",
"title": "Vendor model version changes without notice",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 4,
"detectability": 4,
"mitigationProgress": 54,
"mitigationEffectiveness": 65,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Supplier Manager",
"dueDate": "2026-07-22",
"evidence": "Vendor notice clause missing from service agreement.",
"mitigations": [
"Require version pinning",
"Monitor model release notes",
"Add supplier notification clause"
]
},
{
"id": "R-024",
"title": "Incomplete documentation for experiments",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Model development and training",
"probability": 3,
"impact": 3,
"detectability": 2,
"mitigationProgress": 72,
"mitigationEffectiveness": 65,
"status": "In mitigation",
"approvalStatus": "Approved",
"owner": "ML Engineer",
"dueDate": "2026-07-09",
"evidence": "Experiment parameters captured for latest three runs.",
"mitigations": [
"Track datasets and parameters",
"Store model artifacts",
"Record evaluation results"
]
},
{
"id": "R-025",
"title": "MLOps pipeline failure delays release validation",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Model development and training",
"probability": 2,
"impact": 4,
"detectability": 3,
"mitigationProgress": 68,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "DevOps Lead",
"dueDate": "2026-07-16",
"evidence": "Pipeline retry logic added, full test pending.",
"mitigations": [
"Stabilize CI/CD pipeline",
"Add test artifacts",
"Automate metric validation"
]
},
{
"id": "R-026",
"title": "Weak access control for model administration",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Design",
"probability": 3,
"impact": 5,
"detectability": 3,
"mitigationProgress": 64,
"mitigationEffectiveness": 80,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "IAM Lead",
"dueDate": "2026-07-15",
"evidence": "Role-based permissions configured, audit review pending.",
"mitigations": [
"Define admin roles",
"Enable MFA",
"Audit privileged actions"
]
},
{
"id": "R-027",
"title": "Ethical review not completed before release",
"dimension": "Human",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 3,
"impact": 5,
"detectability": 2,
"mitigationProgress": 25,
"mitigationEffectiveness": 90,
"status": "Open",
"approvalStatus": "Pending",
"owner": "Responsible AI Lead",
"dueDate": "2026-07-07",
"evidence": "Ethical review meeting scheduled but decision not recorded.",
"mitigations": [
"Complete ethical review",
"Document accountability controls",
"Record reviewer decision"
]
},
{
"id": "R-028",
"title": "Legal review incomplete for privacy obligations",
"dimension": "Organizational",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Data collection and preparation",
"probability": 3,
"impact": 5,
"detectability": 3,
"mitigationProgress": 38,
"mitigationEffectiveness": 90,
"status": "Open",
"approvalStatus": "Pending",
"owner": "Legal Reviewer",
"dueDate": "2026-07-09",
"evidence": "Privacy impact assessment is incomplete.",
"mitigations": [
"Complete privacy impact assessment",
"Review data processing basis",
"Approve retention policy"
]
},
{
"id": "R-029",
"title": "Data quality degradation in supplier feed",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Data collection and preparation",
"probability": 4,
"impact": 4,
"detectability": 3,
"mitigationProgress": 51,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Data Engineer",
"dueDate": "2026-07-19",
"evidence": "Missing value rate increased above tolerance in one feed.",
"mitigations": [
"Add supplier data checks",
"Monitor missing values",
"Create feed rejection rule"
]
},
{
"id": "R-030",
"title": "Stakeholder misalignment on deployment criteria",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Needs identification",
"probability": 2,
"impact": 4,
"detectability": 2,
"mitigationProgress": 80,
"mitigationEffectiveness": 75,
"status": "In mitigation",
"approvalStatus": "Accepted",
"owner": "Project Manager",
"dueDate": "2026-07-05",
"evidence": "Gate criteria agreed except legal approval state.",
"mitigations": [
"Run gate workshop",
"Document acceptance thresholds",
"Confirm executive sponsor decision"
]
},
{
"id": "R-031",
"title": "Model not validated on edge cases",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 3,
"impact": 4,
"detectability": 3,
"mitigationProgress": 53,
"mitigationEffectiveness": 65,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "QA Lead",
"dueDate": "2026-07-13",
"evidence": "Synthetic edge-case tests cover only critical class A.",
"mitigations": [
"Define edge case taxonomy",
"Generate edge-case test set",
"Review failures with domain expert"
]
},
{
"id": "R-032",
"title": "Non-reproducible training run",
"dimension": "Technical",
"domain": "Technical risks",
"lifecyclePhase": "Model development and training",
"probability": 3,
"impact": 4,
"detectability": 3,
"mitigationProgress": 47,
"mitigationEffectiveness": 70,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "ML Engineer",
"dueDate": "2026-07-12",
"evidence": "Random seeds captured, dependency lock incomplete.",
"mitigations": [
"Lock dependencies",
"Record random seeds",
"Store training environment metadata"
]
},
{
"id": "R-033",
"title": "Supplier compliance status unknown",
"dimension": "Organizational",
"domain": "Legal and ethical risks",
"lifecyclePhase": "Data collection and preparation",
"probability": 3,
"impact": 4,
"detectability": 4,
"mitigationProgress": 41,
"mitigationEffectiveness": 80,
"status": "Open",
"approvalStatus": "Pending",
"owner": "Supplier Manager",
"dueDate": "2026-07-21",
"evidence": "Supplier security and privacy questionnaire not returned.",
"mitigations": [
"Request supplier assessment",
"Review data processing agreement",
"Add supplier risk score"
]
},
{
"id": "R-034",
"title": "Funding constraint blocks final validation testing",
"dimension": "Organizational",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Testing and performance evaluation",
"probability": 2,
"impact": 4,
"detectability": 2,
"mitigationProgress": 50,
"mitigationEffectiveness": 60,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Finance Lead",
"dueDate": "2026-07-18",
"evidence": "Additional validation budget requested.",
"mitigations": [
"Prioritize critical validation tests",
"Reforecast testing budget",
"Seek sponsor approval"
]
},
{
"id": "R-035",
"title": "Alert fatigue from excessive monitoring notifications",
"dimension": "Human",
"domain": "Strategic and organizational risks",
"lifecyclePhase": "Deployment, support, and monitoring",
"probability": 3,
"impact": 3,
"detectability": 3,
"mitigationProgress": 59,
"mitigationEffectiveness": 60,
"status": "In mitigation",
"approvalStatus": "Pending",
"owner": "Operations Lead",
"dueDate": "2026-07-23",
"evidence": "Monitoring thresholds produce too many low-priority alerts.",
"mitigations": [
"Define alert severity tiers",
"Group duplicate alerts",
"Tune alert thresholds"
]
}
]
}